The 3-2-1 backup rule is the gold standard for data protection: it guarantees redundancy even when one backup medium fails, one location burns down, and one backup gets corrupted — simultaneously.

Not all data is equally critical. Prioritize based on Recovery Point Objective (RPO) — how much data loss is acceptable — and business impact.

Standard backups are not enough against modern ransomware. Sophisticated variants wait silently for days or weeks, then encrypt backups before triggering the ransom note. Design backups to survive this:

1. Immutable backup copies
   Enable WORM (Write Once, Read Many) or Object Lock on your cloud backup. Set a minimum retention of 30 days immutability. Cost: ~$0.01/GB/mo. This alone defeats most ransomware attacks.
2. Separate backup admin credentials
   The account used to manage backups must be separate from regular admin accounts. Attackers who compromise Domain Admin cannot access backup administration. Use a dedicated backup admin account with MFA and no other permissions.
3. Air-gap at least one copy
   Connect an external HDD for weekly backups and disconnect it from the network after. Store it offsite. A fully offline backup cannot be encrypted by any software — it survives even full domain compromise.
4. Alert on backup deletion attempts
   Any attempt to delete or modify immutable backups should trigger an immediate alert (email + SMS). Ransomware often deletes backups 24–72 hours before the ransom note appears. Alerting early gives you time to act.
5. Test restoration quarterly
   Quarterly: restore a random file from backup and verify contents. Annually: full DR drill — simulate a complete site failure and restore from scratch using only documented procedures. Document the time it took and what went wrong.